package main

import (
	//"html/template"
	"log"
	"net/http"
	"text/template"
)

// 转义测试
func escape(w http.ResponseWriter, r *http.Request) {
	// 正常显示
	t, _ := template.New("foo").Parse(`{{define "T"}}Hello1, {{.}}!{{end}}`)
	t.ExecuteTemplate(w, "T", "<script>alert('you have been pwned')</script>")
	// 正常显示
	//t, _ = template.New("foo").Parse(`{{define "T"}}Hello2, {{.}}!{{end}}`)
	//t.ExecuteTemplate(w, "T", template.HTML("<script>alert('you have been pwned')</script>"))
}

func main() {
	http.HandleFunc("/escape", escape)       // 设置转义
	err := http.ListenAndServe(":9090", nil) // 设置监听的端口
	if err != nil {
		log.Fatal("ListenAndServe: ", err)
	}
}
